PT-2015-6957 · Drupal · Drupal Hsts Module

Published 2015-08-18 · Updated 2017-07-26 · CVE-2015-5505

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal HSTS module versions 6.x-1.x before 6.x-1.1 Drupal HSTS module versions 7.x-1.x before 7.x-1.2

Description The issue is related to the improper implementation of the "include subdomains" directive in the HTTP Strict Transport Security (HSTS) module for Drupal. This causes the HSTS policy to not be applied to subdomains, allowing man-in-the-middle attackers to have an unspecified impact.

Recommendations For Drupal HSTS module version 6.x-1.x, update to version 6.x-1.1 or later. For Drupal HSTS module version 7.x-1.x, update to version 7.x-1.2 or later.

Fix

Weakness Enumeration

CWE-17

Related Identifiers

CVE-2015-5505

Affected Products

Drupal Hsts Module

References · 7

• https://drupal.org/node/2507543 · Patch
• https://drupal.org/node/2507563 · Vendor Advisory
• https://drupal.org/node/2507539 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-5505 · Security Note
• http://openwall.com/lists/oss-security/2015/07/04/4 · Note
• http://securitytracker.com/id/1037633 · Note
• http://securityfocus.com/bid/75276 · Note